Integrity verification device and integrity verification method

Abstract

An integrity verification device, in which software is executed by one of one or more electronic control units connected to an in-vehicle network system, includes: a verification schedule determiner that determines a verification timing at which to verify the integrity of the software; an integrity verifier that, for the software, determines, at the verification timing determined for the software, whether first integrity information, that is information for verifying the integrity of the software and that corresponds to at least part of the software corresponding to a verification scope, matches second integrity information, that is information calculated from at least part of the software at the verification timing, and determines that the integrity of the software is ensured when the first integrity information and the second integrity information match; and a verification priority determiner that determines a verification priority that affects determining of the verification timing or the verification scope.

The invention claimed is: 
     
         1 . An integrity verification device that verifies an integrity of one or more pieces of software in an in-vehicle network system,
 wherein each of the one or more pieces of software is executed by one of one or more electronic control units connected to the in-vehicle network system, and   the integrity verification device comprises:
 a processor; and 
 a memory including a program that, when executed by the processor, causes the processor to function as:
 a verification schedule determiner that determines a verification timing at which to verify the integrity of each of the one or more pieces of software; 
 an integrity verifier that, for each piece of software among the one or more pieces of software, determines, at the verification timing determined for the piece of software, whether first integrity information matches second integrity information, and determines that the integrity of the piece of software is ensured when the first integrity information and the second integrity information match, the first integrity information being information for verifying the integrity of the piece of software and that corresponds to at least a part of the piece of software corresponding to a verification scope, and the second integrity information being information calculated from at least a part of the piece of software at the verification timing; and 
 a verification priority determiner that determines a verification priority that affects determining of the verification timing or the verification scope, 
 
   wherein in response to receiving a notification indicating a change in a vehicle state, the verification priority determiner identifies a specific piece of software, from the one or more pieces of software, being related to the change in the vehicle state and changes the verification priority for the specific piece of software to be higher, wherein the change in the vehicle state includes at least one of: a travel state of a vehicle changing to an automated driving state, a connection to an external network being established, or a communication anomaly being detected; and   dynamically changing the verification priority for the specific piece of software in accordance with the change in the vehicle state, and immediately verifying integrity accordingly.   
     
     
         2 . The integrity verification device according to  claim 1 ,
 wherein the verification schedule determiner determines the verification timing of one piece of software among the one or more pieces of software such that a verification frequency of the one piece of software increases as the verification priority of the one piece of software increases.   
     
     
         3 . The integrity verification device according to  claim 1 ,
 wherein the integrity verifier determines the verification scope of one piece of software among the one or more pieces of software such that the verification scope broadens as the verification priority of the one piece of software increases.   
     
     
         4 . The integrity verification device according to  claim 1 ,
 wherein the verification priority determiner changes the verification priority of the specific piece of software in accordance with the vehicle state of the vehicle in which the in-vehicle network system is installed.   
     
     
         5 . The integrity verification device according to  claim 4 ,
 wherein the vehicle state further includes at least one of being stopped, traveling, performing automated driving, being in a diagnostic mode, charging, updating, communicating with the external network, or not communicating with the external network.   
     
     
         6 . The integrity verification device according to  claim 5 ,
 wherein in accordance with the vehicle state, the verification priority determiner changes the verification priority for the specific piece of software for which content of processing by the specific piece of software changes in accordance with the vehicle state.   
     
     
         7 . The integrity verification device according to  claim 1 ,
 wherein the one or more pieces of software is any one of an overall piece of software run on the electronic control unit, a hypervisor serving as a virtualization platform run on the electronic control unit, an operating system, a virtual machine, an application, a process, or a file.   
     
     
         8 . The integrity verification device according to  claim 1 ,
 wherein the one or more pieces of software include a plurality of pieces of software each implementing one of a plurality of virtual machines.   
     
     
         9 . The integrity verification device according to  claim 1 , wherein the program, when executed by the processor, further causes the processor to function as:
 an anomaly monitorer that detects an anomalous state indicating at least one of the communication anomaly pertaining to the specific piece of software and an anomaly in a usage amount of a second memory and a second processor included in each of the one or more electronic control units,   wherein the verification priority determiner raises the verification priority corresponding to the specific piece of software, among the one or more pieces of software, for which the anomalous state is detected.   
     
     
         10 . An integrity verification method that verifies an integrity of one or more pieces of software in an in-vehicle network system,
 wherein each of the one or more pieces of software is executed by one of one or more electronic control units connected to the in-vehicle network system, and   the integrity verification method comprises:
 determining a verification timing at which to verify the integrity of each of the one or more pieces of software; 
 for each piece of software among the one or more pieces of software, determining, at the verification timing determined for the piece of software, whether first integrity information matches second integrity information, and determining that the integrity of the piece of software is ensured when the first integrity information and the second integrity information match, the first integrity information being information for verifying the integrity of the piece of software and that corresponds to at least a part of the piece of software corresponding to a verification scope, and the second integrity information being information calculated from at least a part of the piece of software at the verification timing; and 
 determining a verification priority that affects determining of the verification timing or the verification scope; 
   wherein in response to receiving a notification indicating a change in a vehicle state, the integrity verification method identifies a specific piece of software, from the one or more pieces of software, being related to the change in the vehicle state and changes the verification priority for the specific piece of software to be higher, wherein the change in the vehicle state includes at least one of: a travel state of a vehicle changing to an automated driving state, a connection to an external network being established, or a communication anomaly being detected; and   dynamically changing the verification priority for the specific piece of software in accordance with the change in the vehicle state, and immediately verifying integrity accordingly.